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Sir : 

The above-identified utility patent application is 
transmitted herewith for filing. 
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1. 39 Page English Appln., including 65 Claims and an 
Abstract; 

2. 4 Sheets of Drawings, Figs. 1-4; 
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Applicant or Patentee: Thomas R. Packwood 
Serial or Patent Mo. : 
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For: RISK ASSESSMENT AND MANAGEMENT SYSTEM 



VERIFIED STATEMENT (DECLARATION CLAIMING SMALL ENTITY STATUS) 
(37 CFR 1.9(f) and 1.27(c) - SMALL BUSINESS CONCERN 

I hereby declare that I am 

[ ] the owner of the small business concern identified below: 
[X an official of the small business concern empowered to act on behalf 
of the concern identified below: 

NAME OF SMALL BUSINESS CONCERN UNION STATE BANK 

ADDRESS OF CONCERN 100 DUTCH HILL RO AD 

ORANGEBURG > NEW YORK 10962 

I hereby declare that the above-identified small business concern qualifies as 
? o75^ business concern as defined in 13 CFR 121.12, and reproduced in 37 CFR 
1.9(d), for purposes of paying reduced fees to the United States Patent and 
Trademark Office, m that the number of employees of the concern, including those 
s^^A ^^^^-^^^^^^^ ^^^^ exceed 500 persons. For purposes of this statement, 

(1) the number of employees of the business concern is the average over the 
previous fiscal year of the concern of the persons employed on a full-time, part- 
time or temporary basis during each of the pay periods of the fiscal year, and 

(2) concerns are affiliates of each other when either, directly or indirectly, 
one concern controls or has the power to control the other, or a third party or 
parties controls or has the power to control both. 

I hereby _ declare that rights under contract or law have been conveyed to and 
remain with the small business concern identified above with regard to the 
invention, entitled RISK ASSESSMENT AND MANAGEMENT SYSTEM 



by inventor (s) Thomas R. Packwood 
described in 



[X] the specification filed herewith 

[ ] application serial no._ , filed_ 

[ ] patent no. , issued 



If the_ rights held by the above-identified small business concern are not 
exclusive, _ each individual, concern or organization having rights to the 
invention is listed below and no rights to the invention are held by any person, 
?^ 1 inventor, who could not qualify as an independent inventor under 

. l._9(c), if that person made the invention, or by any concern which would 
not qualify as a small business concern under 37 CFR 1.9(d) or a nonprofit 
organization under 37 CFR 1.9(e). NOTE: Separate verified statements are 
required from each named person, concern or organization having rights to the 
invention averring to their status as small entities. (37 CFR 1.27) 



NAME _ 
ADDRESS 



[ ] INDIVIDUAL [ ] SMALL BUSINESS CONCERN [ ] NONPROFIT ORGANIZATION 



NAME _ 
ADDRESS 



[ ] INDIVIDUAL [ ] SMALL BUSINESS CONCERN [ ] NONPROFIT ORGANIZATION 

I acknowledge the duty to file, in this application or patent, notification of 
any charge m status resulting in loss of entitlement to small entity status 
prior to paying, or at the time of paying, the earliest of the issue fee or any 
maintenance fee due after the date on which status as a small entity is no longer 
appropriate. (37 CFR 1.28(b)) xunyer 



I hereby declare that all statements made herein of my own knowledge are true and 
that all statements made on information and belief are believed to be true; and 
further that these statements were made with the knowledge that willful false 
statements and the like so made are punishable by fine or imprisonment, or both, 
under section 1001 of Title 18 of the United States Code, and that such willful 
false statements may jeopardize the validity of the application, any patent 
issuing thereon, or any patent to which this verified statement is directed. 



Robert E. Blackburn 
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TITLE OF PERSON OTHER THAN OWNER General Counsel/Assistant Sec^itlTT" 

ADDRESS OF PERjg^ S I^Q^G IQQ Dutch Hill Road, Orangeburg, New York 1096;^ 
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RISK ASSESSMENT AND MANAGEMENT SYSTEM 



FIELD AND BACKGROUND OF THE INVENTION 

The present invention relates to a business management 
tool and^r more particularly, to a new and useful method for 
identifying, evaluating and responding to risks associated 
with a business operation, such as in a financial institution. 

Effective business management depends on many different 
factors, including personnel, facilities and systems. Small 
businesses can be operated relatively efficiently when the 
scale of business operations is such that the owner can easily 
know how each aspect of the business is doing. Once a 
business grows so that additional tiers of management are 
needed, it becomes increasingly difficult for a single person 
to effectively understand how all parts of the business are 
operating. Often, the details of how parts of a business 
operate are lost as information about each part flows upward 
in summaries and status reports. At the same time, it is not 
efficient for an upper-level manager or medium to large 



business owner to constantly oversee each individual operation 
of the business. 

Many factors affecting the overall operation of a 
business can be measured and quantified using definite values. 
For example, most companies prepare and review balance sheets 
and income statements to evaluate their health and operating 
efficiency. These statements measure and quantify the 
financial health of a company by taking a "snapshot" of the 
company's financial position at a given moment in time. 

Another important criteria that can be evaluated for a 
business is the risk associated with different facilities, 
activities and functions of the business. Generally, risk is 
a measure of the potential loss versus gain for any given act 
or omission related to a business operation. For a given 
risk, there are levels, or values, which quantify the risk and 
can be used to determine if the risk is too great to be 
acceptable. If the risk associated with a particular business 
can be managed effectively, the business should operate 
efficiently and remain a viable, ongoing concern. 

The operation of a business often entails many different 
aspects and details which are sometimes difficult to compile 
and present in a manageable format to the persons in position 
to act on the information. Different risks to a business may 
exceed planned parameters set to help manage the particular 
risks, but that information does not reach the management due 
to lack of communication or information systems breakdowns. 
In such a case, the risks to a business become unmanaged, and 
the likelihood that the business will fail or perform less 
efficiently is greatly increased. 

Therefore, it is especially desirable to provide business 
management, especially at the board of directors level, with 
a concise, efficient and prompt mechanism for reviewing risk 
factors which may proliferate through voluminous reports that 
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encompass complex and numerous business operations. The 
provision of such mechanisms can become especially important 
in the operations of financial institutions, such as banks, 
since early identification and assessment is needed to assure 
5 sound fiscal management and detect potential fraud. 

Several patents disclosing predictive methods for 
evaluating risk and offering risk management tools for 
businesses are known. 

U.S. Patent 5,963,910 describes a computer-based 
10 management system that enables users to optimize a strategy 

for defining overall risk management choices. ''Predictive 
metrics'^ are employed for quantifying outcomes of a particular 
& business mission. A predictive metric is a parameter that can 

be measured and controlled by the agent, e.g. a manager, 
^ 15 responsible for controlling the desired outcome. A software 

]; program evaluates and optimizes business strategies based on 

y the mission and prioritized desired outcomes. The software 

r uses data processing subroutines to analyze the relationship 

between sets of data and determinative factors, such as 
g 20 predictive metrics, are formulated to identify factors which 

W yield an optimal solution. The determinative factors are 

S linked together, so that optimizing one factor will cause the 

program to evaluate its negative effects on other factors. 
Multiple strategies can be evaluated using the program by 
25 changing the mission and the input priorities, as well as 

other variables. 

Factors are evaluated using predictive metrics which are 
normalized on a scale of 1-10 and then prioritized based on 
the normalized value. The value can be displayed graphically 
30 using a bar which is sized proportionately to the value. 

Depending on the desired outcome, the predictive metrics are 
ranked from highly desirable to unimportant. Figs. 19-23 of 
U.S. Patent 5,963,910 show the ranking and table display of 



the predictive metrics (referred to as Appendices A-1 to A-5 
in the description of the drawings at column 12) . The metrics 
are preprogrammed as part of the software based on prior 
selection and/or research. 

U.S. Patent 5,696,907 relates to a system and method of 
conducting risk and credit analysis of financial service 
applications, such as car loan applications. A pre-programmed 
neural network computer is used to make decisions normally 
made by a credit manager. Related data in each application 
are placed together in groups, such as employment stability, 
credit history, etc. Each group contains variables used to 
evaluate the risk and credit. 

The variables that are used by the system are then 
quantified as numeric or categorical values. Prior history 
data is entered to produce a range of values for each numeric 
variable. The range of values is normalized. Then, the 
vulnerability of each categorical data is determined by 
mapping what proportion of prior applicants in each category 
have produced unacceptable results minus what proportion have 
produced acceptable results. A series of heuristic rules are 
programmed and the prior history data is processed using the 
rules and regression analysis to weight the different 
variables. Data from a new application may then be processed 
against the weighted neural network system to determine if the 
application will be approved or denied. 

U.S. Patent 5,852,811 teaches a program for managing 
personal financial information. One aspect of the invention 
includes an assessment of the investment risk preferences of 
the user. A report can be generated to assist the user in 
selecting investments based in part on the risk preferences 
input previously. The report prioritizes the investments 
based on programmed optimization functions using the input 
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from the user and available financial data. A specific report 
form and risk assessment method is not provided. 

Other patents of interest teaching database methods 
include U.S. Patent 5,227,967 for a method of managing 
5 security instrument data using categorized information stored 

in a database. First, different types of investment assets 
are categorized by attributes. The attributes are in turn 
placed in functionally related groups. For a given security 
instrument, only data for the attributes contained in the 
10 functionally related groups identified with that type of 

instrument is stored and retrieved to make reports about the 
status of that instrument. 
O U.S. Patent 3,703,630 discloses a monitor board for 

[5 identifying the utilization of production facilities using 

4; 15 luminescent strips. Different products are identified at 

J; different locations on the board. The amount of lighted strip 

is proportionate to the quantity being displayed. A computer 
J" having an optimization program drives the display and can show 

percent use, marginal cost of production and other numbers 
2 20 associated with product production using limited plant 

"i:^ facilities. The computer and monitor board are used to 

Q provide rapid "what if" analysis of one or more production 

facilities . 

A task management system incorporating a bar chart in 
25 which the area contained by each bar represents the amount of 

resources needed can be found in U.S. Patent 5,016,170. A 
computer-driven composite display of many related tasks is 
assembled by determining the tasks to be completed and showing 
the tasks as rectangular bars. The orientation and sizes of 
30 the bars relative to each indicate dependency of completion of 

one task on another and the time and resources needed to 
complete each task. The system is particularly well suited to 



construction crew management. Values for bars may be adjusted 
by changing the inputs to the computer driving the display. 

U.S. Patent 5^ 095;. 429 is for a financial information 
system having a provision for prioritizing data. Data is 
entered into a cell in an input window. If the cell is 
locked, it is prioritized over data previously entered in 
other cells, and any recalculation is based on the locked 
cell, which is not permitted to change. 

None of the prior systems provide or suggest a method for 
evaluating and managing risk by selecting criteria and 
assigning both risk and relevancy levels. While one of the 
prior methods is an evaluation method using weights to 
prioritize factors, the values of the factors are not taken 
from current business operations and are predictive metrics 
only. Similarly, the prior credit risk evaluation method uses 
normalized prior numeric data to determine the vulnerability 
of a particular category of data, and then it compares new 
application data using programmed rules and preset 
vulnerability calculations for each criteria. Each piece of 
application data is not evaluated for compliance with a 
standard, but rather, a rule is applied to combined data in 
order to predict future performance based on prior results. 

A method for providing a snapshot of the current levels 
of risks associated with the operation of a business is needed 
to help evaluate business performance and assess compliance 
with standards set by the owner or Board of Directors, 
identify otherwise undetected risks and aid in the overall 
management of a business. 

SUMMARY OF THE INVENTION 

In accordance with the invention, a business risk 
assessment and management reporting method is provided which 
includes identifying a series of predetermined risk factors 
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associated with the operation of a business such as a bank, 
evaluating each risk factor to determine risk level values for 
each risk factor, determining the actual risk level for each 
of the risk factors and generating a risk management report 
having visual indicates displayed with each risk factor. 

It is an object of the invention to provide a method of 
evaluating a business using a time-fixed snapshot report of 
risk factors. 

It is a further object of the invention to provide a 
mechanism for centralizing and automating reporting of the 
risks associated with a business to allow more accurate 
evaluation of the business risk versus reward equation. 

Another object of the invention is to provide a method 
whereby management personnel can set criteria for risk factors 
determined to be important to operating a business and then 
quickly evaluate the business based on the criteria. The risk 
factors are all quantified with a measurable characteristic. 

In accordance with a preferred embodiment of the method 
of the invention, three ranges of risk level values-danger, 
caution and normal risk level— are selected for each of the 
chosen risk factors. The ranges for each risk factor are 
determined based on management's perception of what values are 
acceptable for each factor for the normal range, how large a 
warning range is desired for the caution range for each factor 
and at what point the measured value of the risk factor 
indicates a danger to the business operation. As used herein, 
management is intended to include the owner of a business, the 
Board of Directors of a corporate type entity, executive 
officers of a company and other management level personnel 
charged with operation of one or more business units of a 
company. 

The ranges may be selected by upper, management personnel 
or by operating managers who may be closer to day-to-day 



considerations which cause fluctuations in risk that have been 
identified for evaluation. Factors which are considered high 
risk;, or low tolerance, may have their ranges set or reviewed 
by executive personnel or a Board of Directors. 

Each of the risk factors and their assigned ranges of 
risk level values are further categorized by the immediacy of 
the factor to the operation of the business; that is, its 
time-sensitivity, importance and overall ranking as a 
critically important factor. A "risk tolerance" value is then 
assigned to the risk factor. 

Once the risk factors have been determined, risk level 
ranges set and risk tolerances identified, the system provides 
measurements of existing risk which can be compared by various 
weightings of the risk factors. 

Another aspect of the invention is a report which 
presents the comparison of desired and actual levels of risk 
for each risk factor in a form of visual indica, such as a 
chart using color coding and grouping, to permit a user to 
quickly identify problems and areas of concern. Thus, in 
accordance with a further aspect of the invention, the 
inventive method provides risk assessment management in a 
unique, color-coded report format. The report can be broken 
into sections for each level of risk tolerance so that urgent, 
low risk tolerance factors which have an unacceptable risk 
level are more noticeable and are not confused with higher 
tolerance items with unacceptable risk levels. 

In a further embodiment of the invention, the report 
includes a detailed action plan for risk factors identified as 
being outside of the acceptable range. The action plan 
supplements the brief format of the report to provide 
explanations for each risk factor which is outside the 
acceptable range, identify the current status of the risk 
factor and propose a corrective action plan for evaluation by 



management receiving the report. Thus^. the report can be 
quickly viewed to determine problem areas^ while the detailed 
action plans can be reviewed based on the managements' 
perception of which problems are most critical to the 
business . 

The various features of novelty which characterize the 
invention are pointed out in detail in the claims annexed to 
and forming a part of this disclosure. For a better 
understanding of the invention, its operating advantages and 
specific objects attained by its uses, reference is made to 
the accompanying drawings and descriptive matter in which a 
preferred embodiment of the invention is illustrated. 



BRIEF DESCRIPTION OF THE DRAWINGS 

In the drawings : 

Fig. 1 is a flowchart showing the method of the inventions- 
Fig. 2 is a second flowchart identifying steps for 

preparing a report of results obtained using the 

method of Fig. 1; 
Fig. 3 is a sample report sheet used to present the risk 

assessment information of the method of the 

invention to a manager or business owner; and 
Fig. 4 is a second embodiment of a report sheet. 



DESCRIPTION OF THE PREFERRED EMBODIMENTS 

Referring now to the drawings, in which like reference 
numerals are used to refer to the same or similar elements, 
Fig. 1 illustrates the steps for using the risk assessment and 
management method of the invention. The method relies upon 
the principle that if the risks associated with a business are 
managed properly, then the business will operate efficiently 
and remain a viable entity. The method is designed to permit 
a senior level manager of a business to quickly obtain and 
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evaluate a business operation with many different aspects in 
order to efficiently manage each of ^the different aspects 
without having to know the details of each aspect. As noted 
above, used herein^, management is intended to include the 
owner of a business, the Board of Directors of a corporate 
type entity, executive officers of a company and other 
management level personnel charged with operation of one or 
more business units of a company. 

The method of the invention permits the management of a 
business to select risk factors and identify the parameters 
for each risk factor. A report is generated based on the 
comparison of actual risk values for the risk factors. The 
report is an exception reporting mechanism which quickly 
identifies non-compliant risk factors. The risk factors and 
parameters, or ranges of risk level values, may be 
periodically reviewed by management for applicability to the 
business and validity of the selected ranges. 

Referring to Fig. 1, in accordance with the inventive 
method, a series of risk factors relating to a business 
operation must be selected 100. The risk factors are factors 
that affect the operation of the business as a viable entity. 
Each of the selected risk factors should be capable of being 
measured and quantified. Late payments received by the 
business, for example, can be measured and quantified by the 
number of days the payment is late. Other risk factors which 
might be selected, depending on the type of business, include: 
differences between interest rate on savings and interest rate 
on loans; rate of turnover of employees; days of product in 
inventory; accounts receivable aging; or the number of loans 
in default. Any number of risk factors which are believed to 
be related to the success of the business can be selected. 

For each risk factor selected, at least two ranges of 
risk level values must be set 110. One range of risk level 



values includes acceptable measured values for the risk 
factor;, while the other range includes- measured values which 
are unacceptable. The determination of what values are 
acceptable and which are unacceptable is typically to be made 
by the management of the business. 

The risk level values are preferably numeric valueS;. 
although alphabetic values or alphanumeric values can be used 
if the ranges of values can be represented on a scale in those 
formats, e.g. risk level values of A-C are acceptable values, 
D-F are unacceptable values. 

Preferably, in accordance with the inventive method, 
there are at least three ranges of risk level values that are 
utilized: an acceptable range, a warning range and an 
unacceptable range. The warning range encompasses those risk 
level values for the risk factor that are both not clearly 
unacceptable and not completely acceptable. The risk level 
values in the warning range may be considered marginal risk 
level values, which are neither good nor bad, but can be 
improved. In a preferred embodiment, the warning range 
indicates a risk factor which is tending toward being 
unacceptable and requires early action to prevent the factor 
from becoming unacceptable. 

Additional risk level value ranges can be added to fine 
tune the classification of the level of risk presented by each 
factor. The unacceptable range, for example, could be further 
divided to identify mildly unacceptable risk level values and 
seriously unacceptable risk level values. Similarly, the 
warning range could be expanded to three ranges covering good 
marginal values, marginal values and bad marginal values. The 
acceptable range could be divided into solidly acceptable, no 
improvement needed and acceptable with improvement possible 
ranges . 
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Once the risk factors have been selected 100 and risk 
level value ranges set 110, a risk tolerance must be assigned 
120 to each risk factor. Risk tolerance is a measure of the 
immediacy of a given factor to the success or failure of the 
business and reflects the management's willingness to permit 
the factor to be non-compliant. A low tolerance factor is one 
which can bring about the demise of the business on its own if 
it is at an unacceptable level and not corrected. A low 
tolerance factor is a high risk to the business. A high 
tolerance factor is one which will not cause the failure of 
the business, but will result in decreased efficiency or 
preventable losses. A high tolerance factor is a low risk to 
the business. 

The immediacy of a factor may be based, for example, on 
time sensitivity, which requires prompt action or upon the 
factor's relative importance as a critical business risk 
factor, or both. 

In a preferred embodiment, there are three levels of risk 
tolerance, high, medium and low. A high tolerance risk factor 
is one which is not likely to cause the business to fail by 
its presence alone. A medium tolerance risk factor is one 
which could cause severe problems if not compensated for and 
corrected. A low tolerance risk factor is one which can 
singly cause the business severe damage or failure and 
presents a high risk to the operation of the business . 

The selection of the risk factors 100, setting of the 
risk level value ranges 110 and assigning risk tolerances 120 
are necessary so that actual risk level values for each risk 
factor can be measured 130 and then compared 140 to the preset 
risk level value ranges. 

When the actual risk level values for each factor are 
measured 130, the measurements may be made manually, or based 
on data input by various parts of the business. The 
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measurement data for each risk factor can be collected and 
stored 135 in an electronic database using an automated system 
in the latter case. 

Comparing the actual risk level values to the risk level 
5 value ranges 14 0 can be done using any known method for 

comparing data values. In a preferred embodiment the 
comparison is done using a simple commercially available 
spreadsheet program, such as Microsoft's EXCEL or Corel's 
QUATTRO PRO on a personal computer. These spreadsheets can be 
10 programmed with formulas used to compare the actual risk level 

values to the ranges and generate an output result indicating 
the actual risk level value and the range in which the actual 
^ risk level value falls. 

u5 Finally, once the comparison 140 has been completed, a 

%1 15 report is generated 150 which is color-coded to provide a fast 

4- visual indication of which risk factors have actual risk level 

S values that are in compliance with the corresponding 

O acceptable range of risk level values. When three ranges are 

used, green is used to indicate compliance with the acceptable 
4- 2 0 range, yellow for the warning range and red to indicate a risk 

m factor with an actual risk level value in the unacceptable 

3 range . 

The risk factors associated with a particular business 
operation or portion of the business can be sorted and grouped 
25 together 145 prior to further enhance the information 

presented to management by the report. For example, risk 
factors relating to production can be grouped separately from 
those relating to sales, or risk factors for one physical 
location of the business can be separated from those of a 
30 second physical business location. 

Fig. 2 shows how a spreadsheet program can be programmed 
to compare measured actual risk level values to preset ranges 
to produce a report. The risk factors selected in step 100 



are entered 200 into the spreadsheet. The ranges of risk 
level values are programmed 210 for ea'ch risk factor. Then, 
a comparison algorithm is programmed 220 to compare entered 
values to the preset ranges. A color-coded output is 
programmed 230 corresponding to the result of the comparison. 

A code indicating the segment of the business operation 
each risk factor relates to can be programmed as well for use 
in sorting and grouping 145 related factors. 

After the spreadsheet is programmed, the actual risk 
level values are entered 240 into the spreadsheet, either 
manually or by extraction from a database, such as Microsoft 
ACCESS, as described above. The actual values are compared 
140 with the preset ranges, and the spreadsheet is then used 
to produce 250 an output showing the actual value 
corresponding to each entered risk factor. The outputs are 
color-coded 260 depending on the results of the comparison 
with the programmed ranges of risk level values to indicate 
acceptable or unacceptable results. Preferably three colors 
and ranges are used, so that each risk factor is described and 
a color coded bar is used to show compliance (green) , caution 
(yellow) or non-compliance (red) . The numeric value, used to 
determine risk level range in which the measured risk factor 
falls, is also presented for assessment of the severity of the 
identified problems. 

The tabulated results can be sorted 270 by tolerance 
level as well, so that low tolerance risk factors are 
presented first as a group for rapid action, while higher 
tolerance level factors are presented separately for less 
urgent action. Finally, the report is published 280 for 
review by management to use in operating the business. The 
report may be published on paper, or wholly electronically, 
through HTML computer language or other standardized digital 
formats for publishing documents. 
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In a further embodiment of the invention, once an initial 
measurement has been taken and subsequent measurements are 
available, a further report is used to summarize changes 
occurring since a previous measurement. Comparison of the 
5 initial and subsequent measurements allows new non-compliant 

and caution factors to be identified so that management can 
determine the reason for any adverse deviation from previously 
acceptable or cautionary values. New compliant factors are 
identified to confirm the effects of remedial actions taken 
10 previously in response to warnings from the reports. 

The measurements and reports can all be compiled manually 
using a simple spreadsheet program, such as Microsoft's EXCEL 
or Corel's QUATTRO PRO. Alternatively, inputs for measured 
values of each risk factor may be taken from a networked 
'fi 15 database and supplied to a database program, such as Microsoft 

^ ACCESS. 

'Jt, Regardless of the input, the spreadsheet program then 

3 compares the actual value of the risk level for each factor to 

^1,^ the predetermined ranges and presents the information using 

£ 20 color coding for easier identification. The risk factors may 

be prearranged by risk tolerance, or coded for sorting. The 
O main report is compared to previous versions, when available, 

to produce the second report listing changes in status of risk 

factors . 

25 Fig. 3 displays a spreadsheet report table 300 used to 

compare and report the risk factor assessment, such as can be 
done using Microsoft's EXCEL or Corel's QUATTRO PRO. The 
first column 310 identifies each risk factor with a text label 
for each factor in cells 315. The second column 320 indicates 

30 the actual measured value of the risk factor in the 

corresponding row of the first column 310. The third column 
330 can include a visual indicator of whether the actual value 
in the corresponding row of second column 320 is in compliance 



or not, such as a green bar for compliance, red for non- 
compliance and yellow for caution when three ranges are used. 

The risk factors in table 300 are sorted by risk 
tolerance level as well, as shown by header rows 340, 341, 
342, which indicate one of three tolerance levels. Low 
tolerance items are listed first below header row 340, since 
they are most essential to the operation of the business being 
evaluated in the report table 300. Medium tolerance items are 
identified below header row 341, and high tolerance items are 
listed last below header row 342. 

Each cell 325 in column 320 is programmed to compare the 
entered actual values in the cells 325 to the pre-selected 
ranges of risk level values for the corresponding risk 
factors. The cells 335 in the visual indicator column 330 are 
programmed to display an appropriate visual indicator, using 
the color coding of green, yellow and red when three ranges of 
risk level values are used, which represents the outcome of 
the comparison of each entered actual value to the pre- 
selected ranges in the cells 325 of the second column 320. 
The actual values entered into cells 325 may be input 
manually, or they may be extracted from a database using 
object linking or other similar data extraction methods. 

Alternatively, the report can be formatted so that 
different tolerance level risk factors are presented in side- 
by-side columns or on separate report pages. Fig. 4 shows one 
such report table 400 which has grouped risk factors according 
to a particular business operation, such as for a bank or 
lending institution, identified in operation description rows 
410, 420, 430. Header columns 411, 412, 413 for each risk 
tolerance are provided below each operation description row 
410, 420, 430. A group of three columns 440, 450, 460 for 
identifying the risk factor, actual risk value and a visual 
indicia, respectively, is provided under each header column 



411, 412, 413 within each grouping identified by an operation 
description row 410, 420, 430. 

The individual risk factors are identified in cells 470, 
with the associated actual risk level value presented in an 
adjacent one of cells 480 and a corresponding visual indicia 
in an adjacent one of cells 490 to visually show the 
compliance of the risk factor. 

Additional operation description rows can be added where 
more departments or divisions exist in the business, or fewer 
can be used as needed. 

As shown in Fig. 4, low tolerance risk factors are shown 
in the left-most group of columns 440, 450, 460, medium risk 
factors in the center group, and high tolerance factors in the 
right-most group 440, 450, 460. This arrangement of the risk 
tolerances is selected due to the English language convention 
of reading from left to right, so that the low tolerance 
factors will be read or seen first, due to the immediacy of 
these items and to stress their importance. Clearly, for 
different cultures or language tendencies, the columns may be 
rearranged as appropriate to indicate the same 
characteristics . 

The reports 300, 400 of Figs. 3 and 4 are particularly 
useful when 50 or more risk factors are selected, since the 
color code indicator immediately shows the management 
reviewing the report whether a risk factor: a) is in compliance 
or not and b) requires attention immediately or in the near 
future. The presentation of the report allows for both a 
quick review of many hundreds of risk factors for non- 
compliance and immediate action, and a more thorough reading 
of the detailed values for each risk factor at a later time. 
Without the reports 300, 400, management would potentially 
have to review many text reports from each business area under 
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his/her purview and then obtain additional detailed 
information about each reported problem. 

The following examples of implementing the method are 
provided to show how the invention can be applied to small and 
large businesses to provide rapid assessments of risk. 

Example 1 

The business which will be evaluated using the risk 
assessment method is a small retail store. First, the owner 
of the retail store business determines what risk factors 
apply to the successful operation of the business. The 
factors must be measurable and quantifiable. For this 
example, the factors selected are: monthly gross sales, value 
of inventory over 30 days old, monthly dollar value of 
returns, monthly value of inventory losses due to theft, 
damage, etc., monthly operating costs and monthly net profit. 
Other factors could be selected for a more detailed report, 
but for the purposes of this example, only these factors will 
be used. 

Acceptable and unacceptable risk level value ranges for 
each risk factor are selected as follows: 



Risk Factor 


Acceptable Values 


Unacceptable Values 


Monthly Gross 
sales 


$20, 000 or more 


$19, 999 or less 


Value of Old 
Inventory 


$10,000 or less 


$10, 001 or more 


Value of Returns 


$4,000 or less 


$4 , 001 or more 


Value of Losses 


$500 or less 


$501 or more 


Monthly 

Operating 

Expenses 


$5,000 or less 


$5, 001 or more 


Monthly net 
Profit 


$10, 500 or more 


$10,501 or less 



These risk factors are used to label rowS;. and the 
corresponding ranges are programmed into adjacent cells in an 



EXCEL spreadsheet as formulas so that actual values for each 
risk factor can later be entered into the spreadsheet cell and 
compared to the pre-selected ranges above. 

Each risk factor is then assigned a relevancy, or risk 
tolerance level, of low, medium or high tolerance for 
unacceptable measured values based on the importance to the 
overall success of the business. The monthly gross sales, and 
monthly net profit are assigned low tolerance levels, while 
the value of returns, value of losses and monthly operating 
expense are assigned to the medium tolerance level, and the 
value of old inventory is assigned the highest tolerance 
level . 

The actual values for each identified risk factor are 
determined using known business report information. In this 
example, the actual values used for each factor are, 
respectively, $30,534, $8,789, $7,432, $555, $4,932 and 
$17,692. These numbers are entered into the corresponding 
pre-assigned spreadsheet cell, which uses the programmed 
formula to compare the entered actual value to the pre- 
selected ranges, above, and determines which range the entered 
actual value is within. A visual indicator, such as color 
code, is produced in the cell adjacent the actual value in the 
same row, and the table is sorted by risk tolerance level, 
from lowest to highest. The sorted and color coded report is 
generated as follows (displayed colors in parentheses) : 



Low Tolerance 


Risk Factor 


Actual Values 


Visual Indicator 


Monthly Gross 
Sales 


$30,534 


[Green] 


Monthly Net 
Profit 


$17, 629 


[Green] 


Mediiom Tolerance 


Risk Factor 


Actual Values 


Visual Indicator 


Value of Returns 


$7,432 


[Red] 


Value of Losses 


$555 


[Red] 
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Monthly 

Operating 

Expenses 


$4,923 


[Green] 


High Tolerance 


Risk Factor 


Actual Values 


Visual Indicator 


Value of Old 
Inventory 


$8,789 


[Green] 



Using the report, the business owner can quickly see that 
while sales and profits are acceptable, there are unacceptable 
losses from theft or damage and returns of merchandise are 
excessive. 

Example 2 

A second business which is evaluated using the method of 
the invention is a regional bank. The bank has thirty 
branches and a central headquarters. The central headquarters 
comprises operations such as loans, finance, data processing 
and compliance. The management at the central administration 
location wants to be able to assess their day-to-day branch 
operations, as well as the centralized functions of the 
headquarters location. The bank identifies about three 
hundred risk factors which are grouped according to whether 
they relate to branch operations or to one of the central 
headquarters operation areas. The bank divides the risk 
factors according to whether they as associated with branch 
operations, the bank's loan department, its finance 
department, the data processing operations or the compliance 
department . 

Some of the branch operations risk factors which are 
selected include: latest compliance regulatory exam rating, 
quarterly teller over and short count, open audit and 
regulatory findings over twelve months old, variance of year- 
to-date budget versus actual operating income, number of 
branch manager meetings during past twelve months, current 
internal audit rating for each branch, number of branches 
reporting operating losses in last quarter, and months since 
last approval of branch operations policy. Loan operations 



risk factors which are selected include: loan allowance as a 
percentage of total loans, number of loan officers with 
portfolios greater than $100 million, asset quality rating, 
percent of loans to total assets, net interest yield on loan 
portfolio, number of appraisals not reviewed by in-house 
reviewer, mortgage loans with expired hazard insurance, and 
percentage of total loans outside lending area of the Bank. 
Finance department factors include: net interest income as a 
percent of average assets, return on common equity, legal risk 
self-assessment, investments as a percent of total assets, 
return on assets, and months since last approval of finance 
operations policies. These lists of factors are not intended 
to be exhaustive, but are only exemplary of the hundreds which 
are used. 

Three ranges of risk level values are chosen for each 
risk factor - an acceptable level, a warning level and an 
unacceptable level. Then, a low, medium or high risk 
tolerance level is assigned to each risk factor. The 
different risk factors are sorted by branch or central 
operations factors, and low, medium and high tolerances and 
are entered into an EXCEL spreadsheet, portions of which 
include the risk factors identified above, as follows: 



Branch operations 


Risk Factor 


Actual Value 


Visual Code 


Low Tolerance 


1. 


Quarterly Teller Over 
& Short count 


3872 


[Green] 


2. 


Open Audit and 
Regulatory Findings 
over 12 Months old 


1 


[Yellow] 


Mediiim Tolerance 


3. 


Variance of Year-to- 
Date Budget versus 
Actual Operating 
Income 


9.4% 


[Green] 


4 . 


Number of Branch 
Manager Meetings 
During Past 12 Months 


10 


[Green] 


5. 


Current Internal Audit 
Rating for Smith 
Branch 


3 


[Yellow] 
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High Tolerance 


6. 


Number of Branches 
Reporting Operating 
losses in Last Quarter 


1 


[Green] 


7 . 


Months Since Last 
Approval of Branch 
Operations Policy 


5 


[Green] 


Loan Operations 


Risk Factor 


Actual Value 


Visual Code 


Low Tolerance 


1. 


Loan Allowance as a 
Percentage of Total 
Loans 


1.3% 


[Green] 


2, 


Number of Loan 
Officers with 
Portfolios Greater 
than $100 Million 


5 


[Red] 


Medium Tolerance 


3. 


Percent of Loans to 
Total Assets 


58.8% 


[Green] 


4. 


Net Interest Yield on 
Loan Portfolio 


5.4% 


[Green] 


5. 


Number of Appraisals 
Not Reviewed by In- 
house Reviewer 


10 


[Red] 


High Tolerance 


6. 


Mortgage Loans with 
Expired Hazard 
Insurance 


4 


[Green] 


7 . 


Percentage of Total 
Loans Outside Lending 
Area of the Bank 


0.2% 


[Green] 


Finance Department 


Risk Factor 


Actual Value 


Visual Code 


Low Tolerance 


1. 


Net Interest Income as 
a Percent of Average 
Assets 


3.75% 


[Green] 


2. 


Return on Common 
Equity 


14.7% 


[Green] 


3. 


Legal Risk Self 
Assessment 


GREEN 


[Green] 


Meditim Tolerance 


4 . 


Investments as a % of 
Total Assets 


34.1% 


[Green] 


5. 


Return on Assets 


1. 19 


[Green] 


High Tolerance 



6, 


Months Since Last 


15 


[Yellow] 




Approval of Policies 



The complete table contains several hundred risk factors 
for many other areas of bank operations. For simplicity and 
space considerations, the report table is truncated as shown 
to include only some of the factors identified above as being 
related to the branch, loan and finance operations. 

The risk factors have been numbered sequentially under 
each operational segment to further improve the report and 
make reference to a particular risk factor easier. The risk 
level value ranges are programmed into the "Actual Value" cell 
using EXCEL formulas, and a color-coded response of red, 
yellow, or green is generated which represents the result of 
the comparison of the actual risk level value to the selected 
ranges for each risk factor. An unacceptable risk level value 
yields a red visual code. Yellow is used to indicate a factor 
which is close to being unacceptable, and green indicates a 
factor which is considered solidly acceptable. 

As an example of a risk factor which is quantified by a 
non-numeric value, the legal risk self-assessment factor has 
three responses: green, yellow and red, determined according 
to an appropriate evaluation of the factor. Accordingly, the 
visual color coding for this factor relies on the entered 
value matching one of the three possible responses. Clearly, 
however, an alphabet representation of the measurement of a 
factor is possible. 

After the table is programmed using EXCEL formulas and 
codes, the actual values are entered into the appropriate 
Actual Value cells, compared to the corresponding programmed 
ranges to generate the color coding in the adjacent column of 
cells, and the report is published for review by a senior 
level manager. The many risk factors which are presented in 
the report are easily and quickly reviewed using the color 



coding to identify unacceptable risk factors while acceptable 
factors are not examined in detail initially. 

Further, for each risk factor which is identified as 
being in the warning or unacceptable ranges in the report of 
the example, or when one of the basic reports 300, 400 of 
Figs. 3 or 4 is used, a detailed action plan can be provided 
with the report. The action plan identifies the risk factor 
and the current status of the risk factor, and provides either 
a proposed corrective action for review by management or 
relates the corrective measures which have been undertaken for 
approval by management. The action plan provides additional 
detail about each non-compliant risk factor which can be 
reviewed based on the risk tolerance associated with the 
factor and the level of non-compliance indicated in the 
report . 

In the case of the example, a detailed action report 
would be provided for each factor which has a Yellow or Red 
visual indicator showing non-compliance, such as the risk 
factor "Number of Loan Officers with Portfolios Greater than 
$100 Million". The action plan for this factor identifies the 
factor, the current status, or value, which is 5 loan 
officers, and the steps being taken to correct the problem - 
evaluate the distribution of loan customers among the loan 
officers- Since this is a high risk/low tolerance item with 
a Red visual indicator showing non-compliance, the problem 
will be identified and the action plan reviewed sooner than 
the action plan for the finance department's problem risk 
factor "Months Since Last Approval of Policies", which is a 
high tolerance/low risk factor with a Yellow caution visual 
indicator. 

Thus, management can quickly prioritize non-compliant 
factors using the report 300, 400 and obtain detailed 
information as needed, rather than having to read several 



detailed action plans or other lengthy text reports first to 
determine which items are a priority. 

A second type of report that can be generated after at 
least one report has been prepared is a comparison of new 
unacceptable items and new acceptable items to show correction 
from prior reports and to identify both new and long term 
problems. The report can be generated using a ^'document 
compare" software program function to compare a prior report 
to the current report. 

While a specific embodiment of the invention has been 
shown and described in detail to illustrate the application of 
the principles of the invention^, it will be understood that 
the invention may be embodied otherwise without departing from 
such principles. 
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WHAT IS CLAIMED IS : 

1. A risk assessment and management reporting method^ 
comprising: 

identifying a plurality of risk factors affecting an 
5 operation being managed; 

evaluating each risk factor to determine at least 
two ranges of risk level values for each risk factor, each 
range of risk level values corresponding to a visual indicia; 

determining actual risk level values for each of the 
10 plurality of risk factors; and 

generating a risk management report having one of 
the visual indicia displayed in conjunction with each risk 
factor;, the particular visual indicia being displayed being 
dependent on which of the at least two ranges of risk level 
tfl 15 values the actual risk level value for the associated risk 

p factor is within. 



Pi 2. a risk assessment and management reporting method 

according to claim 1, further comprising associating one of a 
J? plurality of different risk tolerance levels with each risk 

y 20 factor, the risk tolerance levels indicating a level of 

rj relevancy of the risk factor to the operation. 

3. A risk assessment and management reporting method 
according to claim 2, wherein all risk factors having the same 
risk tolerance level are accumulated in a separate area of the 
25 report for each risk tolerance level. 



4. A risk assessment and management reporting method 
according to claim 3^ further comprising displaying in the 
report the actual risk level value for each risk factor in 
proximity to the risk factor and associated visual indicia. 
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5, A risk assessment and management reporting method 
according to claim 4, wherein there are two ranges of risk 
level values, one range containing unacceptable risk level 
values, the other range containing acceptable risk level 

5 values. 

6. A risk assessment and management reporting method 
according to claim 5, wherein the unique visual indicia 
associated with each range of risk level values comprises a 
color. 

10 7. A risk assessment and management reporting method 

according to claim 6, wherein the colors are red and green. 

8. A risk assessment and management reporting method 
according to claim 1, further comprising displaying in the 
report the actual risk level value for each risk factor in 

15 proximity to the risk factor and associated visual indicia. 

9. A risk assessment and management reporting method 
according to claim 1, wherein there are two ranges of risk 
level values, one range containing unacceptable risk level 
values, the other range containing acceptable risk level 

20 values. 

10. A risk assessment and management reporting method 
according to claim 9, wherein the unique visual indicia 
associated with each range of risk level values comprises a 
color . 
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11. A risk assessment and management reporting method 
according to claim 10, wherein the colors are red and green. 
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12. A risk assessment and management reporting method 
according to claim 1, wherein there are three ranges of risk 
level values, one range containing unacceptable risk level 
values^ a second range containing marginal risk level values 
and the third range containing acceptable risk level values. 

13. A risk assessment and management reporting method 
according to claim 12, wherein the unique visual indicia 
associated with each range of risk level values comprises a 
color . 

14. A risk assessment and management reporting method 
according to claim 13, wherein the colors are red, yellow and 
green. 

15. A risk assessment and the step of management 
reporting method according to claim 1, wherein generating the 
report comprises preparing a computerized spreadsheet having 
a first column identifying each of the plurality of risk 
factors in one of a plurality of rows of the spreadsheet and 
a second column displaying the unique indicia associated with 
each risk factor in the same one of the plurality of rows as 
the associated risk factor. 

16. A risk assessment and management reporting method 
according to claim 15, wherein preparing the computerized 
spreadsheet further comprises programming a formula for each 
risk factor into the spreadsheet for comparing the actual risk 
level value of each risk factor to the at least two ranges of 
risk level values for each risk factor. 

17. A risk assessment and management reporting method 
according to claim 15, further comprising programming a code 



for each formula into the spreadsheet for displaying one of 
the unique visual indicia in the second column dependent upon 
the result of comparing the actual risk level value to the at 
least two ranges of risk level values for each risk factor, 

18. A risk assessment and management reporting method, 
comprising: 

identifying a plurality of risk factors affecting a 
financial institution operation having a plurality of 
operational segments ; 

evaluating each risk factor to determine at least 
two ranges of risk level values for each risk factor, each 
range of risk level values corresponding to a visual indicia; 

determining actual risk level values for each of the 
plurality of risk factors; and 

generating a risk management report having one of 
the visual indicia displayed in conjunction with each risk 
factor, the particular visual indicia being displayed being 
dependent on which of the at least two ranges of risk level 
values the actual risk level value for the associated risk 
factor is within. 

19. A risk assessment and management reporting method 
according to claim 18, further comprising sorting the risk 
factors according to the operational segment of the financial 
institution affected by the risk factors. 

20. A risk assessment and management reporting method 
according to claim 19, further comprising associating one of 
a plurality of different risk tolerance levels with each risk 
factor, the risk tolerance levels indicating a level of 
relevancy of the risk factor to the operation. 
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21. A risk assessment and management reporting method 
according to claim 20, wherein in the graphical risk 
management report all risk factors having the same risk 
tolerance level are accumulated in a separate area of the 
report for each risk tolerance level. 

22. A risk assessment and management reporting method 
according to claim 21^ further comprising displaying in the 
report the actual risk level value for each risk factor in 
proximity to the risk factor and associated visual indicia. 

23. A risk assessment and management reporting method 
according to claim 22, wherein there are three ranges of risk 
level values, one range containing unacceptable risk level 
values, a second range containing marginal risk level values 
and the third range containing acceptable risk level values. 

24. A risk assessment and management reporting method 
according to claim 23, wherein the unique visual indicia 
associated with each range of risk level values comprises a 
color. 

25. A risk assessment and management reporting method 
according to claim 24, wherein the colors are red, yellow and 
green. 

26. A risk assessment and management reporting method 
according to claim 25, further comprising displaying in the 
report the actual risk level value for each risk factor in 
proximity to the risk factor and associated visual indicia. 
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27. A risk assessment and management reporting method 
according to claim 18, wherein the financial institution being 
managed is a bank. 

28. A risk assessment and management reporting method 
5 according to claim 18, wherein at least some of the plurality 

of the risk factors identified are selected from the group 
consisting of net interest income as a percent of average 
assets, return on common equity, legal risk self- assessment, 
investments as a percent of total assets, return on assets, 

10 and months since last approval of operations policies, latest 

compliance regulatory exam rating, quarterly teller over and 
short count, open audit and regulatory findings over twelve 
months old, variance of year-to-date budget versus actual 
operating income, number of branch manager meetings during 

15 past twelve months, current internal audit rating for each 

branch, number of branches reporting operating losses in last 
quarter, months since last approval of branch operations 
policy, loan allowance as a percentage of total loans, number 
of loan officers with portfolios greater than $100 million, 

20 asset quality rating, percent of loans to total assets, net 

interest yield on loan portfolio, number of appraisals not 
reviewed by in-house reviewer, mortgage loans with expired 
hazard insurance, and percentage of total loans outside 
lending area of the Bank. 

25 29. A risk assessment and management reporting system 

comprising: 

means for identifying a plurality of risk factors 
associated with an operation being managed; 

each of the risk factors having at least two 
30 different risk level value ranges, each risk level value range 

corresponding to a visual indicia; 
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an actual risk level value for each risk factor; and 
a graphical risk management report on a computer, 
the report having one of the visual indicia displayed in 
conjunction with each risk factor, the particular visual 
indicia being displayed being dependent on which of the ranges 
of risk level values the actual risk level value for the 
associated risk factor is within. 

30. An assessment and risk management reporting system 
according to claim 29, further comprising means for 
associating one of a plurality of different risk tolerance 
levels with each risk factor, the risk tolerance levels 
indicating a level of relevancy of the risk factor to the 
operation . 

31. A risk management reporting system according to 
claim 30, wherein all risk factors having the same risk 
tolerance level are accumulated in a separate area of the risk 
management report for each risk tolerance level. 

32. Whereas risk and assessment and management reporting 
system according to claim 31, the actual risk level value for 
each risk factor is displayed in proximity to the risk factor 
and associated visual indicia. 

33. A risk assessment and management reporting system 
according to claim 32, wherein the risk level value ranges 
comprise one range containing unacceptable risk level values, 
and the other range containing acceptable risk level values. 

34. A risk assessment and management reporting system 
according to claim 33, wherein the visual indicia associated 
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with each range of risk level values comprises different 
colors . 

35, A risk assessment and management reporting system 
according to claim 34, wherein the colors are red and green. 

5 36. A risk assessment and management reporting system 

according to claim 29, wherein the actual risk level value for 
each risk factor in proximity to the risk factor displayed and 
associated visual indicia. 

37. A risk assessment and management reporting system 
10 according to claim 29, wherein ranges of risk level values 

comprise one range containing unacceptable risk level values, 
and the other range containing acceptable risk level values. 

38. A risk assessment and management reporting system 
according to claim 37, wherein the visual indicia associated 

15 with each range of risk level values comprises different 

colors . 

39. A risk assessment and management reporting system 
according to claim 38, wherein the colors are red and green. 

40. A risk assessment and management reporting system 
20 according to claim 29, wherein the ranges of risk level values 

comprised one range containing unacceptable risk level values, 
a second range containing marginal risk level values and a 
third range containing acceptable risk level values. 

41. A risk assessment and management reporting system 
25 according to claim 40, wherein the visual indicia associated 



with each range of risk level values comprise different 
colors . 

42. A risk assessment and management reporting system 
according to claim 41, wherein the colors are red, yellow and 
green. 

43. A risk assessment and management reporting system 
according to claim 29, wherein the report comprises a 
computerized spreadsheet having a first column identifying 
each of the plurality of risk factors in one of a plurality of 
rows of the spreadsheet and a second column displaying the 
unique indicia associated with each risk factor in the same 
one of the plurality of rows as the associated risk factor and 
means for publishing the spreadsheet . 

44. A risk assessment and management reporting system 
according to claim 43, wherein the computerized spreadsheet 
further comprises formula for each risk factor programmed into 
the spreadsheet, each formula comparing the actual risk level 
value of the associated risk factor to the at least two ranges 
of risk level values for the associated risk factor to 
determine which of the at least two ranges the actual risk 
level value is within. 

45. A risk assessment and management reporting system 
according to claim 44, further comprising a code programmed 
into the spreadsheet for each formula for displaying one of 
the visual indicia in the second column dependent upon the 
result of comparing the actual risk level value to the at 
least two ranges of risk level values for each risk factor. 
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46. A risk assessment and management reporting system 
according to claim 29, wherein the operation being managed is 
a bank having a plurality of operational segments. 

47- A risk assessment and management reporting system 
according to claim 46, further comprising means for sorting 
the risk factors according to the operational segment of the 
bank the risk factors affect, 

48. A risk assessment and management reporting system 
according to claim 47, further comprising means for 
associating one of a plurality of different risk tolerance 
levels with each risk factor, the risk tolerance levels 
indicating a level of relevancy of the risk factor to the 
operation . 

49. A risk assessment and management reporting system 
according to claim 48, wherein all risk factors having the 
same risk tolerance level are accumulated in a separate area 
of the report for each risk tolerance level. 

50. A risk assessment and management reporting system 
according to claim 49, further comprising means for displaying 
in the report the actual risk level value for each risk factor 
in proximity to the risk factor and associated visual indicia. 

51. A risk assessment and management reporting system 
according to claim 50, wherein the means for generating the 
report comprises a computerized spreadsheet having a first 
column identifying each of the plurality of risk factors in 
one of a plurality of rows of the spreadsheet and a second 
column displaying the indicia associated with each risk factor 
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in the same one of the plurality of rows as the associated 
risk factor and means for publishing the spreadsheet. 

52. A risk assessment and management reporting system 
according to claim 51, wherein the computerized spreadsheet 

5 further comprises a formula for each risk factor programmed 

into the spreadsheet, each formula comparing the actual risk 
level value of the associated risk factor to the at least two 
ranges of risk level values for the associated risk factor to 
determine which of the at least two ranges the actual risk 
10 level value is within, 

53. A risk assessment and management reporting system 
according to claim 52, further comprising a code programmed 
into the spreadsheet for each formula for displaying one of 
the visual indicia in the second column dependent upon the 

15 result of comparing the actual risk level value to the at 

least two ranges of risk level values for each risk factor. 

54. A risk assessment and management reporting system 
according to claim 53, further comprising a third column in 
the computerized spreadsheet for displaying the actual risk 

20 level value entered for each risk factor in the corresponding 

row of the spreadsheet. 

55. A risk assessment and management reporting system 
according to claim 54, wherein the formula for each risk 
factor is programmed into the corresponding cell of the third 

25 column. 
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56. A risk assessment and management report comprising: 
a plurality of separate visible areas each 

corresponding to one of a plurality of different risk 
tolerance levels; 

a plurality of risk factors each associated with one 
of the risk tolerance levels, all of the risk factors having 
the same risk tolerance level being listed in the same 
separate visible area; 

at least two ranges of risk level values associated 
with each of the plurality of risk factors, each of the at 
least two ranges of risk level values corresponding to a 
visual indicia; 

each risk factor having an actual risk level value, 
the actual risk level value for each risk factor and the 
visual indicia corresponding to the range of risk level values 
in which the actual risk level value of the risk factor is 
within being displayed associated with their corresponding 
risk factor in the corresponding separate area. 

57. An assessment and management report according to 
claim 56, further comprising a computerized spreadsheet for 
displaying the plurality of risk factors and the associated 
unique visual indicia. 

58. An assessment and management report according to 
claim 57, wherein for each risk factor, the at least two 
ranges of risk level values are programmed into the 
computerized spreadsheet as a formula for comparing with the 
actual risk level value for the risk factor. 

59. An assessment and management report according to 
claim 58, further comprising a code programmed into the 
computerized spreadsheet for each risk factor for displaying 
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one of the unique visual indicia in association with the risk 
factor^ dependent upon the result of the comparison of the 
actual risk level value to the at least two ranges of risk 
level value for the risk factor. 

60. An assessment and management report according to 
claim 59, wherein the at least two ranges of risk level values 
for each risk factor comprises three ranges. 

61. An assessment and management report according to 
claim 60, wherein the three ranges are an unacceptable value 
range, a marginal value range and an acceptable value range. 

62. An assessment and management report according to 
claim 61, wherein the visual indicia comprise different 
colors . 

63. An assessment and management report according to 
claim 62, wherein the colors comprise red, yellow and green. 

64. An assessment and management report according to 
claim 56, wherein each of the visual indicia comprises a 
color. 

65. An assessment and management report according to 
claim 64, wherein the colors for the visual indicia comprise 
red, yellow and green. 
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ABSTRACT 

A method of analyzing and presenting a series of risk 
factors associated with the operation of a business, such as 
a bank. Quantifiable risk factors are identified. Ranges of 
5 acceptable and unacceptable values for the factors are 

selected and arranged to each factor. Each risk factor has an 
immediacy value, or risk tolerance, assigned to it. A 
business is evaluated by measuring the actual values for each 
factor found in the business, comparing the actual values to 
10 the user-defined acceptable value ranges for each factor and 

creating a report identifying unacceptable valued risk factors 
and their immediacy value to the business. The measuring, 
evaluating and reporting may be automated using a computer, or 
portions can be done manually. 
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Atty. Docket No.: J532-002 US 



Declaration and Power of Attorney For Patent 

Application 

English Language Declaration 

As a below named inventor, I hereby declare that: 

My residence, post office address and citizenship are as 
stated below next to my name, 

I believe I am the original, first and sole inventor (if 
only one name is listed below) or an original, first and joint 
inventor (if plural names are listed below) of the subject matter 
which is claimed and for which a patent is sought on the 
invention entitled 

RISK ASSESSMENT AND MANAGEMENT SYSTEM 



the specification of which (check one) : 
[X] is attached hereto 

[ ] was filed on as 

Application Serial No. and 

was amended on (if applicable) . 

I hereby state that I have reviewed and understand the 
contents of the above -identified specification, including the 
claims, as amended by any amendment referred to above. 

I acknowledge the duty to disclose information which is 
material to patentability as defined in Title 37, Code of Federal 
Regulations, § 1.5S. 

I hereby claim foreign priority benefits under Title 35, 
United States Code, §119 of any foreign application (s) for patent 
or inventor's certificate listed below and have also identified 
below any foreign application for patent or inventor's 
certificate having a filing date before that of the application 
on which priority is claimed: 

Prior Foreign Applications Priority Claimed 



Yes No 

(Number) (Country) (Day/Month/Year Filed) [ ] [ ] 

Yes No 

(Number) (Country) (Day/Month/Year Filed) [ ] [ ] 

I hereby claim the benefits under Title 35, United States 
Code, §119 (e) of the following United States Provisional 
Application: 

Priority Claimed 



(Number) (Day/Month/Year Filed) [ ] [ ] 



Atty. Docket: J532-002 US 



I hereby claim the benefit under Title 35, United States 
Code, §120 of any United States application (s) listed below, and 
insofar as the subject matter of each of the claims of this 
application is not disclosed in the prior United States 
application in the manner provided by the first paragraph of 
Title 35, United States Code, §112, I acknowledge the duty to 
disclose information which is material to patentability as 
defined in Title 37, Code of Federal Regulations, §1.56 which 
became available between the filing date of the prior application 
and the national or PCT international filing date of this 
application. 

This application is a of U.S. Application 



Serial No. Filing Date Status (Patented, Pending, Abandoned) 

I hereby declare that all statements made herein of my own 
knowledge are true and that all statements made on information 
and belief are believed to be true; and further that these 

o statements were made with the knowledge that willful false 
statements and the like so made are punishable by fine or 
im:prisonment, or both, under Section 1001 of Title 18 of the 

"z: United States Code and that such willful false statements may 

t jeopardize the validity of the application or any patent issued 

4^ thereon . 

fj POWER OF ATTORNEY: As a named inventor, I hereby appoint the 
S following attorney (s) and/or agent (s) to prosecute this 

application and transact all business in the Patent and Trademark 

Office connected therewith. 

p Angelo Notaro 

Reg, No. 27,664 

ffv Mark A. Conklin 

Reg. No. 39,148 
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NOTARO £c MICHALOS P.O. 
100 Dutch Hill Road 
Suite 110 
Orangeburg, New York 10962-2100 



Direct Telephone Calls to: (914) 359-7700 



Thomas R. PACKWOOD 


Full name of sole ox fjrst investor 


/\po \ S, 2000 


Inventor's signature 

Darien , Connecticut 


Date 


Residence " " 

U.S. 


Citizenship 

285-A Noroton Avenue 




Darien, Connecticut 06820 

Post Office Address 





Peter C. Michalos Martin A, Levitin 

Reg. No. 28,643 Reg. No. 24,479 

John Zaccaria 
Reg. No* 40,241 



